Bug 2135343 (CVE-2022-3500)

Summary:	CVE-2022-3500 keylime: exception handling and impedance match in tornado_requests
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ansasaki, dueno, ksrot, lvrabec, mpeters, pkoncity, scorreia, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keylime 6.5.1	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in keylime. This issue occurs due to improperly handled exceptions. A rogue agent could potentially create errors on the verifier that stopped attestation attempts for that host, leaving it in an attested state but not verified.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-07 04:33:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2135345, 2135346, 2135373, 2138170
Bug Blocks:	2134645

Description Sandipan Roy 2022-10-17 10:41:05 UTC

Keylime is a remote attestation solution. In some rare circumstances,
an operating system level failure -- such as a network driver crash --
happens and keylime error handling procedures do not properly treat
this situation, causing the verifier component to quit and not
recover. The verifier's state machine remains in "verified" state and
the associated database is no longer updated for this agent.

The expected outcome here, as with other communication failures, would
be that keylime would retry and recover. This does not happen in this
situation.

There's some more details in the PR fixing the issue, at
https://github.com/keylime/keylime/pull/1128

Reproducers: No known reproducers; this was encountered in some scale
testing and did not happen quickly or reliably.

Affected versions: < 6.5.1
Patched versions: 6.5.1

Comment 2 Sandipan Roy 2022-10-27 13:31:14 UTC

Created keylime tracking bugs for this issue:

Affects: fedora-all [bug 2138170]

Comment 3 errata-xmlrpc 2022-11-15 16:00:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8444 https://access.redhat.com/errata/RHSA-2022:8444

Comment 4 Product Security DevOps Team 2022-12-07 04:33:08 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3500